Create a credential - Qoder CN Series - Alibaba Cloud Documentation Center

Request headers

Header	Required	Description
`Authorization`	Yes	Bearer token for authentication. Format: `Bearer $QODER_PAT`.
`Content-Type`	Yes	Must be `application/json`.

Path parameters

Parameter	Type	Required	Description
`vault_id`	string	Yes	Unique identifier of the vault to add the credential to.

Request body

Field	Type	Required	Description
`mcp_server_url`	string	Yes	URL of the MCP server this credential authorizes.
`protocol`	string	Yes	Transport protocol. One of `sse` or `streamable_http`.
`type`	string	Yes	Credential type. Currently only `static_bearer` is supported.
`access_token`	string	Yes	Access token presented to the MCP server. Required when `type` is `static_bearer`.

Example request

curl -X POST "https://api.qoder.com.cn/api/v1/cloud/vaults/vault_019e3bb940277f0db05ab74291acf6ef/credentials" \
  -H "Authorization: Bearer $QODER_PAT" \
  -H "Content-Type: application/json" \
  -d '{
    "mcp_server_url": "https://example.com/mcp-stream",
    "protocol": "streamable_http",
    "type": "static_bearer",
    "access_token": "your-access-token"
  }'

Example response

HTTP 201 Created

{
  "id": "vcred_019e3bb98877759e862750b495c1fce8",
  "vault_id": "vault_019e3bb940277f0db05ab74291acf6ef",
  "mcp_server_url": "https://example.com/mcp-stream",
  "protocol": "streamable_http",
  "type": "static_bearer",
  "status": "active",
  "created_at": "2026-05-18T15:34:35.387093Z",
  "updated_at": "2026-05-18T15:34:35.387093Z"
}

Response fields

Field	Type	Description
`id`	string	Unique identifier of the credential, prefixed with `vcred_`.
`vault_id`	string	ID of the vault that owns the credential.
`mcp_server_url`	string	URL of the MCP server this credential authorizes.
`protocol`	string	Transport protocol. One of `sse` or `streamable_http`.
`type`	string	Credential type.
`status`	string	Credential state. New credentials default to `active`.
`created_at`	string	Creation timestamp in ISO 8601 format.
`updated_at`	string	Last-updated timestamp in ISO 8601 format.

Errors

HTTP	Type	Trigger
400	`invalid_request_error`	A required field is missing: `Field 'access_token' is required for static_bearer type.`
401	`authentication_error`	Missing or invalid authentication token.
404	`not_found_error`	The specified vault does not exist or was deleted.

Notes

For security, the access_token value is never returned in the response.
A vault can hold multiple credentials.
Credentials become active immediately after creation.

For the full error envelope, see Errors.